13efa11bbSBrian Somers.Dd July, 1997 23efa11bbSBrian Somers.Dt "libalias" 3 33efa11bbSBrian Somers.Os 43efa11bbSBrian Somers.Sh NAME 53efa11bbSBrian Somers.Nm "libalias" 63efa11bbSBrian SomersPacket Aliasing Library. A collection of 73efa11bbSBrian Somersfunctions for aliasing and de-aliasing 83efa11bbSBrian Somersof IP packets, intended for masquerading and 93efa11bbSBrian Somersnetwork address translation (NAT). 103efa11bbSBrian Somers 113efa11bbSBrian Somers.Sh SYNOPSIS 123efa11bbSBrian Somers.Fd #include <netinet/in.h> 133efa11bbSBrian Somers.Fd #include <alias.h> 143efa11bbSBrian Somers 153efa11bbSBrian SomersFunction prototypes are given in the main body 163efa11bbSBrian Somersof the text. 173efa11bbSBrian Somers 183efa11bbSBrian Somers.Sh CONTENTS 193efa11bbSBrian Somers.Bd -literal -offset left 203efa11bbSBrian Somers1. Introduction 213efa11bbSBrian Somers2. Initialization and Control 223efa11bbSBrian Somers 2.1 PacketAliasInit() 238ddc51bcSEivind Eklund 2.2 PacketAliasUninit() 248ddc51bcSEivind Eklund 2.3 PacketAliasSetAddress() 258ddc51bcSEivind Eklund 2.4 PacketAliasSetMode() 268ddc51bcSEivind Eklund 2.5 PacketAliasSetFWBase() 273efa11bbSBrian Somers3. Packet Handling 283efa11bbSBrian Somers 3.1 PacketAliasOut() 293efa11bbSBrian Somers 3.2 PacketAliasIn() 303efa11bbSBrian Somers4. Port and Address Redirection 313efa11bbSBrian Somers 4.1 PacketAliasRedirectPort() 323efa11bbSBrian Somers 4.2 PacketAliasRedirectAddr() 333efa11bbSBrian Somers 4.3 PacketAliasRedirectDelete() 343efa11bbSBrian Somers5. Fragment Handling 353efa11bbSBrian Somers 5.1 PacketAliasSaveFragment() 363efa11bbSBrian Somers 5.2 PacketAliasGetFragment() 373efa11bbSBrian Somers 5.3 PacketAliasFragmentIn() 383efa11bbSBrian Somers6. Miscellaneous Functions 393efa11bbSBrian Somers 6.1 PacketAliasSetTarget() 403efa11bbSBrian Somers 6.2 PacketAliasCheckNewLink() 413efa11bbSBrian Somers 6.3 PacketAliasInternetChecksum() 423efa11bbSBrian Somers7. Authors 433efa11bbSBrian Somers8. Acknowledgments 443efa11bbSBrian Somers 453efa11bbSBrian SomersAppendix A: Conceptual Background 463efa11bbSBrian Somers A.1 Aliasing Links 473efa11bbSBrian Somers A.2 Static and Dynamic Links 483efa11bbSBrian Somers A.3 Partially Specified Links 493efa11bbSBrian Somers A.4 Dynamic Link Creation 503efa11bbSBrian Somers.Ed 513efa11bbSBrian Somers 523efa11bbSBrian Somers.Sh 1. Introduction 533efa11bbSBrian SomersThis library is a moderately portable 543efa11bbSBrian Somersset of functions designed to assist 553efa11bbSBrian Somersin the process of IP masquerading and 563efa11bbSBrian Somersnetwork address translation. Outgoing 573efa11bbSBrian Somerspackets from a local network with 583efa11bbSBrian Somersunregistered IP addresses can be aliased 593efa11bbSBrian Somersto appear as if they came from an 603efa11bbSBrian Somersaccessible IP address. Incoming packets 613efa11bbSBrian Somersare then de-aliased so that they are sent 623efa11bbSBrian Somersto the correct machine on the local network. 633efa11bbSBrian Somers 643efa11bbSBrian SomersA certain amount of flexibility is built 653efa11bbSBrian Somersinto the packet aliasing engine. In 663efa11bbSBrian Somersthe simplest mode of operation, a 673efa11bbSBrian Somersmany-to-one address mapping takes place 683efa11bbSBrian Somersbetween local network and the packet 693efa11bbSBrian Somersaliasing host. This is known as IP 703efa11bbSBrian Somersmasquerading. In addition, one-to-one 713efa11bbSBrian Somersmappings between local and public addresses 723efa11bbSBrian Somerscan also be implemented, which is known as 733efa11bbSBrian Somersstatic NAT. In between these extremes, 743efa11bbSBrian Somersdifferent groups of private addresses 753efa11bbSBrian Somerscan be linked to different public addresses, 763efa11bbSBrian Somerscomprising several distinct many-to-one 773efa11bbSBrian Somersmappings. Also, a given public address 783efa11bbSBrian Somersand port can be staticly redirected to 793efa11bbSBrian Somersa private address/port. 803efa11bbSBrian Somers 813efa11bbSBrian SomersThe packet aliasing engine was designed 823efa11bbSBrian Somersto operate in user space outside of the 833efa11bbSBrian Somerskernel, without any access to private 843efa11bbSBrian Somerskernel data structure, but the source code 853efa11bbSBrian Somerscan also be ported to a kernel environment. 863efa11bbSBrian Somers 873efa11bbSBrian Somers.Sh 2. Initialization and Control 883efa11bbSBrian SomersTwo specific functions, PacketAliasInit() 893efa11bbSBrian Somersand PacketAliasSetAddress(), must always be 903efa11bbSBrian Somerscalled before any packet handling may be 913efa11bbSBrian Somersperformed. In addition, the operating mode 923efa11bbSBrian Somersof the packet aliasing engine can be customized 933efa11bbSBrian Somersby calling PacketAliasSetMode(). 943efa11bbSBrian Somers.Ss 2.1 PacketAliasInit() 953efa11bbSBrian Somers 963efa11bbSBrian Somers.Ft void 973efa11bbSBrian Somers.Fn PacketAliasInit "void" 983efa11bbSBrian Somers 993efa11bbSBrian SomersThis function has no argument or return 1003efa11bbSBrian Somersvalue and is used to initialize internal 1013efa11bbSBrian Somersdata structures. The following mode bits 1023efa11bbSBrian Somersare always set after calling 1033efa11bbSBrian SomersPacketAliasInit(). See section 2.3 for 1043efa11bbSBrian Somersthe meaning of these mode bits. 1053efa11bbSBrian Somers.Bd -literal -offset indent 1063efa11bbSBrian Somers PKT_ALIAS_USE_SAME_PORTS 1073efa11bbSBrian Somers PKT_ALIAS_USE_SOCKETS 1083efa11bbSBrian Somers PKT_ALIAS_RESET_ON_ADDR_CHANGE 1093efa11bbSBrian Somers 1103efa11bbSBrian Somers.Ed 1113efa11bbSBrian SomersThis function will always return the packet 1123efa11bbSBrian Somersaliasing engine to the same initial state. 1133efa11bbSBrian SomersPacketAliasSetAddress() must be called afterwards, 1143efa11bbSBrian Somersand any desired changes from the default mode 1153efa11bbSBrian Somersbits listed above require a call to 1163efa11bbSBrian SomersPacketAliasSetMode(). 1173efa11bbSBrian Somers 1183efa11bbSBrian SomersIt is mandatory that this function be called 1193efa11bbSBrian Somersat the beginning of a program prior to any 1203efa11bbSBrian Somerspacket handling. 1218ddc51bcSEivind Eklund.Ss 2.2 PacketAliasUnInit() 1228ddc51bcSEivind Eklund 1238ddc51bcSEivind Eklund.Ft void 1248ddc51bcSEivind Eklund.Fn PacketAliasUnInit "void" 1258ddc51bcSEivind Eklund 1268ddc51bcSEivind EklundThis function has no argument or return 1278ddc51bcSEivind Eklundvalue and is used to clear any resources 1288ddc51bcSEivind Eklundattached to internal data structures. 1298ddc51bcSEivind Eklund 1308ddc51bcSEivind EklundThis functions should be called when a 1318ddc51bcSEivind Eklundprogram stop using the aliasing engine; 1328ddc51bcSEivind Eklundit do, among other things, clear out any 1338ddc51bcSEivind Eklundfirewall holes. To provide backwards 1348ddc51bcSEivind Eklundcompatibility and extra security, it is 1358ddc51bcSEivind Eklundadded to the atexit() chain by 1368ddc51bcSEivind EklundPacketAliasInit(). Calling it multiple 1378ddc51bcSEivind Eklundtimes is harmless. 1388ddc51bcSEivind Eklund.Ss 2.3 PacketAliasSetAddress() 1393efa11bbSBrian Somers 1403efa11bbSBrian Somers.Ft void 1413efa11bbSBrian Somers.Fn PacketAliasSetAddress "struct in_addr addr" 1423efa11bbSBrian Somers 1433efa11bbSBrian SomersThis function sets the source address to which 1443efa11bbSBrian Somersoutgoing packets from the local area network 1453efa11bbSBrian Somersare aliased. All outgoing packets are remapped 1463efa11bbSBrian Somersto this address unless overridden by a static 1473efa11bbSBrian Somersaddress mapping established by 1483efa11bbSBrian SomersPacketAliasRedirectAddr(). 1493efa11bbSBrian Somers 1503efa11bbSBrian SomersIf the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit 1513efa11bbSBrian Somersis set (the default mode of operation), then 1523efa11bbSBrian Somersthe internal aliasing link tables will be reset 1533efa11bbSBrian Somersany time the aliasing address changes, as if 1543efa11bbSBrian SomersPacketAliasReset() were called. This is useful 1553efa11bbSBrian Somersfor interfaces such as ppp where the IP 1563efa11bbSBrian Somersaddress may or may not change on successive 1573efa11bbSBrian Somersdial-up attempts. 1583efa11bbSBrian Somers 1593efa11bbSBrian SomersIf the PKT_ALIAS_RESET_ON_ADDR_CHANGE mode bit 1603efa11bbSBrian Somersis set to zero, this function can also be used to 1613efa11bbSBrian Somersdynamically change the aliasing address on a 1623efa11bbSBrian Somerspacket to packet basis (it is a low overhead 1633efa11bbSBrian Somerscall). 1643efa11bbSBrian Somers 1653efa11bbSBrian SomersIt is mandatory that this function be called 1663efa11bbSBrian Somersprior to any packet handling. 1678ddc51bcSEivind Eklund.Ss 2.4 PacketAliasSetMode() 1683efa11bbSBrian Somers 1693efa11bbSBrian Somers.Ft void 1703efa11bbSBrian Somers.Fn PacketAliasSetMode "int mode" "int mask" 1713efa11bbSBrian Somers 1723efa11bbSBrian SomersThis function sets or clears mode bits 1733efa11bbSBrian Somersaccording to the value of 1743efa11bbSBrian Somers.Em mode . 1753efa11bbSBrian SomersOnly bits marked in 1763efa11bbSBrian Somers.Em mask 1773efa11bbSBrian Somersare affected. The following mode bits are 1783efa11bbSBrian Somersdefined in alias.h: 1793efa11bbSBrian Somers.Bl -hang -offset left 1803efa11bbSBrian Somers.It PKT_ALIAS_LOG. 1813efa11bbSBrian SomersEnables logging /var/log/alias.log. The log file 1823efa11bbSBrian Somersshows total numbers of links (icmp, tcp, udp) each 1833efa11bbSBrian Somerstime an aliasing link is created or deleted. Mainly 1843efa11bbSBrian Somersuseful for debugging when the log file is viewed 1853efa11bbSBrian Somerscontinuously with "tail -f". 1863efa11bbSBrian Somers.It PKT_ALIAS_DENY_INCOMING. 1873efa11bbSBrian SomersIf this mode bit is set, all incoming packets 1883efa11bbSBrian Somersassociated with new TCP connections or new 1893efa11bbSBrian SomersUDP transactions will be marked for being 1903efa11bbSBrian Somersignored (PacketAliasIn() return code 1913efa11bbSBrian SomersPKT_ALIAS_IGNORED) by the calling program. 1923efa11bbSBrian SomersResponse packets to connections or transactions 1933efa11bbSBrian Somersinitiated from the packet aliasing host or 1943efa11bbSBrian Somerslocal network will be unaffected. This mode 1953efa11bbSBrian Somersbit is useful for implementing a one-way firewall. 1963efa11bbSBrian Somers.It PKT_ALIAS_SAME_PORTS. 1973efa11bbSBrian SomersIf this mode bit is set, the packet aliasing 1983efa11bbSBrian Somersengine will attempt to leave the alias port 1993efa11bbSBrian Somersnumbers unchanged from the actual local port 2003efa11bbSBrian Somersnumber. This can be done as long as the 2013efa11bbSBrian Somersquintuple (proto, alias addr, alias port, 2023efa11bbSBrian Somersremote addr, remote port) is unique. If a 2033efa11bbSBrian Somersconflict exists, an new aliasing port number is 2043efa11bbSBrian Somerschosen even if this mode bit is set. 2053efa11bbSBrian Somers.It PKT_ALIAS_USE_SOCKETS. 2063efa11bbSBrian SomersThis bit should be set when the the packet 2073efa11bbSBrian Somersaliasing host originates network traffic as 2083efa11bbSBrian Somerswell as forwards it. When the packet aliasing 2093efa11bbSBrian Somershost is waiting for a connection from an 2103efa11bbSBrian Somersunknown host address or unknown port number 2113efa11bbSBrian Somers(e.g. an FTP data connection), this mode bit 2123efa11bbSBrian Somersspecifies that a socket be allocated as a place 2133efa11bbSBrian Somersholder to prevent port conflicts. Once a 2143efa11bbSBrian Somersconnection is extablished, usually within a 2153efa11bbSBrian Somersminute or so, the socket is closed. 2163efa11bbSBrian Somers.It PKT_ALIAS_UNREGISTERED_ONLY. 2173efa11bbSBrian SomersIf this mode bit is set, traffic on the 2183efa11bbSBrian Somerslocal network which does not originate from 2193efa11bbSBrian Somersunregistered address spaces will be ignored. 2203efa11bbSBrian SomersStandard Class A, B and C unregistered addresses 2213efa11bbSBrian Somersare: 2223efa11bbSBrian Somers.Bd -literal -offset indent 2233efa11bbSBrian Somers 10.0.0.0 -> 10.255.255.255 (Class A subnet) 2243efa11bbSBrian Somers 172.16.0.0 -> 172.31.255.255 (Class B subnets) 2253efa11bbSBrian Somers 192.168.0.0 -> 192.168.255.255 (Class C subnets) 2263efa11bbSBrian Somers 2273efa11bbSBrian Somers.Ed 2283efa11bbSBrian SomersThis option is useful in the case that 2293efa11bbSBrian Somerspacket aliasing host has both registered and 2303efa11bbSBrian Somersunregistered subnets on different interfaces. 2313efa11bbSBrian SomersThe registered subnet is fully accessible to 2323efa11bbSBrian Somersthe outside world, so traffic from it doesn't 2333efa11bbSBrian Somersneed to be passed through the packet aliasing 2343efa11bbSBrian Somersengine. 2353efa11bbSBrian Somers.It PKT_ALIAS_RESET_ON_ADDR_CHANGE. 2363efa11bbSBrian SomersWhen this mode bit is set and 2373efa11bbSBrian SomersPacketAliasSetAddress() is called to change 2383efa11bbSBrian Somersthe aliasing address, the internal link table 2393efa11bbSBrian Somersof the packet aliasing engine will be cleared. 2403efa11bbSBrian SomersThis operating mode is useful for ppp links 2413efa11bbSBrian Somerswhere the interface address can sometimes 2423efa11bbSBrian Somerschange or remain the same between dial-ups. 2433efa11bbSBrian SomersIf this mode bit is not set, it the link table 2443efa11bbSBrian Somerswill never be reset in the event of an 2453efa11bbSBrian Somersaddress change. 2468ddc51bcSEivind Eklund.It PKT_ALIAS_PUNCH_FW. 2478ddc51bcSEivind EklundThis option make libalias `punch holes' in an 2488ddc51bcSEivind Eklundipfw based firewall for FTP/IRC DCC connections. 2498ddc51bcSEivind EklundThe holes punched are bound by from/to IP address 2508ddc51bcSEivind Eklundand port; it will not be possible to use a hole 2518ddc51bcSEivind Eklundfor another connection. A hole is removed when 2528ddc51bcSEivind Eklundthe connection that use it die. To cater for 2538ddc51bcSEivind Eklundunexpected death of a program using libalias (e.g 2548ddc51bcSEivind Eklundkill -9), changing the state of the flag will 2558ddc51bcSEivind Eklundclear the entire ipfw range allocated for holes. 2568ddc51bcSEivind EklundThis will also happen on the initial call to 2578ddc51bcSEivind EklundPacketAliasSetFWBase(). This call must happen 2588ddc51bcSEivind Eklundprior to setting this flag. 2598ddc51bcSEivind Eklund 2603efa11bbSBrian Somers.El 2618ddc51bcSEivind Eklund 2628ddc51bcSEivind Eklund.Ss 2.5 PacketAliasSetFWBase() 2638ddc51bcSEivind Eklund 2648ddc51bcSEivind Eklund.Ft void 2658ddc51bcSEivind Eklund.Fn PacketAliasSetFWBase "unsigned int base" "unsigned int num" 2668ddc51bcSEivind Eklund 2678ddc51bcSEivind EklundSet IPFW range allocated for punching firewall holes (with the 2688ddc51bcSEivind EklundPKT_ALIAS_PUNCH_FW flag). The range will be cleared for all rules on 2698ddc51bcSEivind Eklundinitialization. 2708ddc51bcSEivind Eklund 2713efa11bbSBrian Somers.Sh 3. Packet Handling 2723efa11bbSBrian SomersThe packet handling functions are used to 2733efa11bbSBrian Somersmodify incoming (remote->local) and outgoing 2743efa11bbSBrian Somers(local->remote) packets. The calling program 2753efa11bbSBrian Somersis responsible for receiving and sending 2763efa11bbSBrian Somerspackets via network interfaces. 2773efa11bbSBrian Somers 2783efa11bbSBrian SomersAlong with PacketAliasInit() and PacketAliasSetAddress(), 2793efa11bbSBrian Somersthe two packet handling functions, PacketAliasIn() 2803efa11bbSBrian Somersand PacketAliasOut(), comprise minimal set of functions 2813efa11bbSBrian Somersneeded for a basic IP masquerading implementation. 2823efa11bbSBrian Somers.Ss 3.1 PacketAliasIn() 2833efa11bbSBrian Somers 2843efa11bbSBrian Somers.Ft int 2853efa11bbSBrian Somers.Fn PacketAliasIn "char *buffer" "int maxpacketsize" 2863efa11bbSBrian Somers 2873efa11bbSBrian SomersAn incoming packet coming from a remote machine to 2883efa11bbSBrian Somersthe local network is de-aliased by this function. 2893efa11bbSBrian SomersThe IP packet is pointed to by 2903efa11bbSBrian Somers.Em buffer , 2913efa11bbSBrian Somersand 2923efa11bbSBrian Somers.Em maxpacketsize 2933efa11bbSBrian Somersindicates the size of the data structure containing 2943efa11bbSBrian Somersthe packet and should be at least as large as the 2953efa11bbSBrian Somersactual packet size. 2963efa11bbSBrian Somers 2973efa11bbSBrian SomersReturn codes: 2983efa11bbSBrian Somers.Bl -hang -offset left 2993efa11bbSBrian Somers.It PKT_ALIAS_ERROR. 3003efa11bbSBrian SomersAn internal error within the packet aliasing 3013efa11bbSBrian Somersengine occured. 3023efa11bbSBrian Somers.It PKT_ALIAS_OK. 3033efa11bbSBrian SomersThe packet aliasing process was successful. 3043efa11bbSBrian Somers.It PKT_ALIAS_IGNORED. 3053efa11bbSBrian SomersThe packet was ignored and not de-aliased. 3063efa11bbSBrian SomersThis can happen if the protocal is unrecognized, 3073efa11bbSBrian Somerspossibly an ICMP message type is not handled or 3083efa11bbSBrian Somersif incoming packets for new connections are being 3093efa11bbSBrian Somersignored (see PKT_ALIAS_DENY_INCOMING in section 3103efa11bbSBrian Somers2.2). 3113efa11bbSBrian Somers.It PKT_ALIAS_UNRESOLVED_FRAGMENT. 3123efa11bbSBrian SomersThis is returned when a fragment cannot be 3133efa11bbSBrian Somersresolved because the header fragment has not 3143efa11bbSBrian Somersbeen sent yet. In this situation, fragments 3153efa11bbSBrian Somersmust be saved with PacketAliasSaveFragment() 3163efa11bbSBrian Somersuntil a header fragment is found. 3173efa11bbSBrian Somers.It PKT_ALIAS_FOUND_HEADER_FRAGMENT. 3183efa11bbSBrian SomersThe packet aliasing process was successful, 3193efa11bbSBrian Somersand a header fragment was found. This is a 3203efa11bbSBrian Somerssignal to retrieve any unresolved fragments 3213efa11bbSBrian Somerswith PacketAliasGetFragment() and de-alias 3223efa11bbSBrian Somersthem with PacketAliasFragmentIn(). 3233efa11bbSBrian Somers.El 3243efa11bbSBrian Somers.Ss 3.2 PacketAliasOut() 3253efa11bbSBrian Somers 3263efa11bbSBrian Somers.Ft int 3273efa11bbSBrian Somers.Fn PacketAliasIn "char *buffer" "int maxpacketsize" 3283efa11bbSBrian Somers 3293efa11bbSBrian SomersAn outgoing packet coming from the local network 3303efa11bbSBrian Somersto a remote machine is aliased by this function. 3313efa11bbSBrian SomersThe IP packet is pointed to by 3323efa11bbSBrian Somers.Em buffer r, 3333efa11bbSBrian Somersand 3343efa11bbSBrian Somers.Em maxpacketsize 3353efa11bbSBrian Somersindicates the maximum packet size permissable 3363efa11bbSBrian Somersshould the packet length be changed. IP encoding 3373efa11bbSBrian Somersprotocols place addresss and port information in 3383efa11bbSBrian Somersthe encapsulated data stream which have to be 3393efa11bbSBrian Somersmodified and can account for changes in packet 3403efa11bbSBrian Somerslength. Well known examples of such protocols 3418ddc51bcSEivind Eklundare FTP and IRC DCC. 3423efa11bbSBrian Somers 3433efa11bbSBrian SomersReturn codes: 3443efa11bbSBrian Somers.Bl -hang -offset left 3453efa11bbSBrian Somers.It PKT_ALIAS_ERROR. 3463efa11bbSBrian SomersAn internal error within the packet aliasing 3473efa11bbSBrian Somersengine occured. 3483efa11bbSBrian Somers.It PKT_ALIAS_OK. 3493efa11bbSBrian SomersThe packet aliasing process was successful. 3503efa11bbSBrian Somers.It PKT_ALIAS_IGNORED. 3513efa11bbSBrian SomersThe packet was ignored and not de-aliased. 3523efa11bbSBrian SomersThis can happen if the protocal is unrecognized, 3533efa11bbSBrian Somersor possibly an ICMP message type is not handled. 3543efa11bbSBrian Somers.El 3553efa11bbSBrian Somers 3563efa11bbSBrian Somers.Sh 4. Port and Address Redirection 3573efa11bbSBrian SomersThe functions described in this section allow machines 3583efa11bbSBrian Somerson the local network to be accessible in some degree 3593efa11bbSBrian Somersto new incoming connections from the external network. 3603efa11bbSBrian SomersIndividual ports can be re-mapped or static network 3613efa11bbSBrian Somersaddress translations can be designated. 3623efa11bbSBrian Somers.Ss 4.1 PacketAliasRedirectPort() 3633efa11bbSBrian Somers 3643efa11bbSBrian Somers.Ft struct alias_link * 3653efa11bbSBrian Somers.Fo PacketAliasRedirectPort 3663efa11bbSBrian Somers.Fa "struct in_addr local_addr" 3673efa11bbSBrian Somers.Fa "u_short local_port" 3683efa11bbSBrian Somers.Fa "struct in_addr remote_addr" 3693efa11bbSBrian Somers.Fa "u_short remote_port" 3703efa11bbSBrian Somers.Fa "struct in_addr alias_addr" 3713efa11bbSBrian Somers.Fa "u_short alias_port" 3723efa11bbSBrian Somers.Fa "u_char proto" 3733efa11bbSBrian Somers.Fc 3743efa11bbSBrian Somers 3753efa11bbSBrian SomersThis function specifies that traffic from a 3763efa11bbSBrian Somersgiven remote address/port to an alias address/port 3773efa11bbSBrian Somersbe redirected to a specified local address/port. 3783efa11bbSBrian SomersThe paramater 3793efa11bbSBrian Somers.Em proto 3803efa11bbSBrian Somerscan be either IPPROTO_TCP or IPPROTO_UDP, as 3813efa11bbSBrian Somersdefined in <netinet/in.h>. 3823efa11bbSBrian Somers 3833efa11bbSBrian SomersIf 3843efa11bbSBrian Somers.Em local_addr 3853efa11bbSBrian Somersor 3863efa11bbSBrian Somers.Em alias_addr 3873efa11bbSBrian Somersis zero, this indicates that the packet aliasing 3883efa11bbSBrian Somersaddress as established by PacketAliasSetAddress() 3893efa11bbSBrian Somersis to be used. Even if PacketAliasAddress() is 3903efa11bbSBrian Somerscalled to change the address after PacketAliasRedirectPort() 3913efa11bbSBrian Somersis called, a zero reference will track this change. 3923efa11bbSBrian Somers 3933efa11bbSBrian SomersIf 3943efa11bbSBrian Somers.Em remote_addr 3953efa11bbSBrian Somersis zero, this indicates to redirect packets from 3963efa11bbSBrian Somersany remote address. Likewise, if 3973efa11bbSBrian Somers.Em remote_port 3983efa11bbSBrian Somersis zero, this indicates to redirect packets originating 3993efa11bbSBrian Somersfrom any remote port number. Almost always, the remote 4003efa11bbSBrian Somersport specification will be zero, but non-zero remote 4013efa11bbSBrian Somersaddresses can be sometimes be useful for firewalling. 4023efa11bbSBrian SomersIf two calls to PacketAliasRedirectPort() overlap in 4033efa11bbSBrian Somerstheir address/port specifications, then the most recent 4043efa11bbSBrian Somerscall will have precedence. 4053efa11bbSBrian Somers 4063efa11bbSBrian SomersThis function returns a pointer which can subsequently 4073efa11bbSBrian Somersbe used by PacketAliasRedirectDelete(). If NULL is 4083efa11bbSBrian Somersreturned, then the function call did not complete 4093efa11bbSBrian Somerssuccessfully. 4103efa11bbSBrian Somers 4113efa11bbSBrian SomersAll port numbers are in network address byte order, 4123efa11bbSBrian Somersso it is necessary to use htons() to convert these 4133efa11bbSBrian Somersparameters from internally readable numbers to 4143efa11bbSBrian Somersnetwork byte order. Addresses are also in network 4153efa11bbSBrian Somersbyte order, which is implicit in the use of the 4163efa11bbSBrian Somers.Em struct in_addr 4173efa11bbSBrian Somersdata type. 4183efa11bbSBrian Somers.Ss 4.2 PacketAliasRedirectAddr() 4193efa11bbSBrian Somers 4203efa11bbSBrian Somers.Ft struct alias_link * 4213efa11bbSBrian Somers.Fo PacketAliasRedirectAddress 4223efa11bbSBrian Somers.Fa "struct in_addr local_addr" 4233efa11bbSBrian Somers.Fa "struct in_addr alias_addr" 4243efa11bbSBrian Somers.Fc 4253efa11bbSBrian Somers 4263efa11bbSBrian SomersThis function desgnates that all incoming 4273efa11bbSBrian Somerstraffic to 4283efa11bbSBrian Somers.Em alias_addr 4293efa11bbSBrian Somersbe redirected to 4303efa11bbSBrian Somers.Em local_addr. 4313efa11bbSBrian SomersSimilarly, all outgoing traffic from 4323efa11bbSBrian Somers.Em local_addr 4333efa11bbSBrian Somersis aliased to 4343efa11bbSBrian Somers.Em alias_addr . 4353efa11bbSBrian Somers 4363efa11bbSBrian SomersIf 4373efa11bbSBrian Somers.Em local_addr 4383efa11bbSBrian Somersor 4393efa11bbSBrian Somers.Em alias_addr 4403efa11bbSBrian Somersis zero, this indicates that the packet aliasing 4413efa11bbSBrian Somersaddress as established by PacketAliasSetAddress() 4423efa11bbSBrian Somersis to be used. Even if PacketAliasAddress() is 4433efa11bbSBrian Somerscalled to change the address after PacketAliasRedirectAddr() 4443efa11bbSBrian Somersis called, a zero reference will track this change. 4453efa11bbSBrian Somers 4463efa11bbSBrian SomersIf subsequent calls to PacketAliasRedirectAddr() 4473efa11bbSBrian Somersuse the same aliasing address, all new incoming 4483efa11bbSBrian Somerstraffic to this aliasing address will be redirected 4493efa11bbSBrian Somersto the local address made in the last function call, 4503efa11bbSBrian Somersbut new traffic all of the local machines designated 4513efa11bbSBrian Somersin the several function calls will be aliased to 4523efa11bbSBrian Somersthe same address. Consider the following example: 4533efa11bbSBrian Somers.Bd -literal -offset left 4543efa11bbSBrian Somers PacketAliasRedirectAddr(inet_aton("192.168.0.2"), 4553efa11bbSBrian Somers inet_aton("141.221.254.101")); 4563efa11bbSBrian Somers PacketAliasRedirectAddr(inet_aton("192.168.0.3"), 4573efa11bbSBrian Somers inet_aton("141.221.254.101")); 4583efa11bbSBrian Somers PacketAliasRedirectAddr(inet_aton("192.168.0.4"), 4593efa11bbSBrian Somers inet_aton("141.221.254.101")); 4603efa11bbSBrian Somers.Ed 4613efa11bbSBrian Somers 4623efa11bbSBrian SomersAny outgoing connections such as telnet or ftp 4633efa11bbSBrian Somersfrom 192.168.0.2, 102.168.0.3, 192.168.0.4 will 4643efa11bbSBrian Somersappear to come from 141.221.254.101. Any incoming 4653efa11bbSBrian Somersconnections to 141.221.254.101 will be directed 4663efa11bbSBrian Somersto 192.168.0.4. 4673efa11bbSBrian Somers 4683efa11bbSBrian SomersAny calls to PacketAliasRedirectPort() will 4693efa11bbSBrian Somershave precedence over address mappings designated 4703efa11bbSBrian Somersby PacketAliasRedirectAddr(). 4713efa11bbSBrian Somers 4723efa11bbSBrian SomersThis function returns a pointer which can subsequently 4733efa11bbSBrian Somersbe used by PacketAliasRedirectDelete(). If NULL is 4743efa11bbSBrian Somersreturned, then the function call did not complete 4753efa11bbSBrian Somerssuccessfully. 4763efa11bbSBrian Somers.Ss 4.3 PacketAliasRedirectDelete() 4773efa11bbSBrian Somers 4783efa11bbSBrian Somers.Ft void 4793efa11bbSBrian Somers.Fn PacketAliasRedirectDelete "struct alias_link *ptr" 4803efa11bbSBrian Somers 4813efa11bbSBrian SomersThis function will delete a specific static redirect 4823efa11bbSBrian Somersrule entered by PacketAliasRedirectPort() or 4833efa11bbSBrian SomersPacketAliasRedirectAddr(). The parameter 4843efa11bbSBrian Somers.Em ptr 4853efa11bbSBrian Somersis the pointer returned by either of the redirection 4863efa11bbSBrian Somersfunctions. If an invalid pointer is passed to 4873efa11bbSBrian SomersPacketAliasRedirectDelete(), then a program crash 4883efa11bbSBrian Somersor unpredictable operation could result, so it is 4893efa11bbSBrian Somersnecessary to be careful using this function. 4903efa11bbSBrian Somers 4913efa11bbSBrian Somers.Sh 5. Fragment Handling 4923efa11bbSBrian SomersThe functions in this section are used to deal with 4933efa11bbSBrian Somersincoming fragments. 4943efa11bbSBrian Somers 4953efa11bbSBrian SomersOutgoing fragments are handled within PacketAliasOut() 4963efa11bbSBrian Somersby changing the address according to any 4973efa11bbSBrian Somersapplicable mapping set by PacketAliasRedirectAddress(), 4983efa11bbSBrian Somersor the default aliasing address set by 4993efa11bbSBrian SomersPacketAliasSetAddress(). 5003efa11bbSBrian Somers 5013efa11bbSBrian SomersIncoming fragments are handled in one of two ways. 5023efa11bbSBrian SomersIf the header of a fragmented IP packet has already 5033efa11bbSBrian Somersbeen seen, then all subsequent fragments will be 5043efa11bbSBrian Somersre-mapped in the same manner the header fragment 5053efa11bbSBrian Somerswas. Fragments which arrive before the header 5063efa11bbSBrian Somersare saved and then retrieved once the header fragment 5073efa11bbSBrian Somershas been resolved. 5083efa11bbSBrian Somers.Ss 5.1 PacketAliasSaveFragment() 5093efa11bbSBrian Somers 5103efa11bbSBrian Somers.Ft int 5113efa11bbSBrian Somers.Fn PacketAliasSaveFragment "char *ptr" 5123efa11bbSBrian Somers 5133efa11bbSBrian SomersWhen PacketAliasIn() returns 5143efa11bbSBrian SomersPKT_ALIAS_UNRESOLVED_FRAGMENT, this 5153efa11bbSBrian Somersfunction can be used to save the pointer to 5163efa11bbSBrian Somersthe unresolved fragment. 5173efa11bbSBrian Somers 5183efa11bbSBrian SomersIt is implicitly assumed that 5193efa11bbSBrian Somers.Em ptr 5203efa11bbSBrian Somerspoints to a block of memory allocated by 5213efa11bbSBrian Somersmalloc(). If the fragment is never 5223efa11bbSBrian Somersresolved, the packet aliasing engine will 5233efa11bbSBrian Somersautomatically free the memory after a 5243efa11bbSBrian Somerstimeout period. [Eventually this function 5253efa11bbSBrian Somersshould be modified so that a callback 5263efa11bbSBrian Somersfunction for freeing memory is passed as 5273efa11bbSBrian Somersan argument.] 5283efa11bbSBrian Somers 5293efa11bbSBrian SomersThis function returns PKT_ALIAS_OK if it 5303efa11bbSBrian Somerswas successful and PKT_ALIAS_ERROR if there 5313efa11bbSBrian Somerswas an error. 5323efa11bbSBrian Somers.Ss 5.2 PacketAliasGetNextFragment() 5333efa11bbSBrian Somers 5343efa11bbSBrian Somers.Ft char * 5353efa11bbSBrian Somers.Fn PacketAliasGetFragment "char *buffer" 5363efa11bbSBrian Somers 5373efa11bbSBrian SomersThis function can be used to retrieve fragment 5383efa11bbSBrian Somerspointers saved by PacketAliasSaveFragment(). 5393efa11bbSBrian SomersThe IP header fragment pointed to by 5403efa11bbSBrian SomersEm buffer 5413efa11bbSBrian Somersis the header fragment indicated when 5423efa11bbSBrian SomersPacketAliasIn() returns PKT_ALIAS_FOUND_HEADER_FRAGMENT. 5433efa11bbSBrian SomersOnce a a fragment pointer is retrieved, it 5443efa11bbSBrian Somersbecomes the calling program's responsibility 5453efa11bbSBrian Somersto free the dynamically allocated memory for 5463efa11bbSBrian Somersthe fragment. 5473efa11bbSBrian Somers 5483efa11bbSBrian SomersPacketAliasGetFragment() can be called 5493efa11bbSBrian Somerssequentially until there are no more fragments 5503efa11bbSBrian Somersavailable, at which time it returns NULL. 5513efa11bbSBrian Somers.Ss 5.3 PacketAliasFragmentIn() 5523efa11bbSBrian Somers 5533efa11bbSBrian Somers.Ft void 5543efa11bbSBrian Somers.Fn PacketAliasFragmentIn "char *header" "char *fragment" 5553efa11bbSBrian Somers 5563efa11bbSBrian SomersWhen a fragment is retrieved with 5573efa11bbSBrian SomersPacketAliasGetFragment(), it can then be 5583efa11bbSBrian Somersde-aliased with a call to PacketAliasFragmentIn(). 5593efa11bbSBrian Somers.Em header 5603efa11bbSBrian Somersis the pointer to a header fragment used as a 5613efa11bbSBrian Somerstemplate, and 5623efa11bbSBrian Somers.Em fragment 5633efa11bbSBrian Somersis the pointer to the packet to be de-aliased. 5643efa11bbSBrian Somers 5653efa11bbSBrian Somers.Sh 6. Miscellaneous Functions 5663efa11bbSBrian Somers 5673efa11bbSBrian Somers.Ss 6.1 PacketAliasSetTarget() 5683efa11bbSBrian Somers 5693efa11bbSBrian Somers.Ft void 5703efa11bbSBrian Somers.Fn PacketAliasSetTarget "struct in_addr addr" 5713efa11bbSBrian Somers 5723efa11bbSBrian SomersWhen an incoming packet not associated with 5733efa11bbSBrian Somersany pre-existing aliasing link arrives at the 5743efa11bbSBrian Somershost machine, it will be sent to the address 5753efa11bbSBrian Somersindicated by a call to PacketAliasSetTarget(). 5763efa11bbSBrian Somers 5773efa11bbSBrian SomersIf this function is not called, or is called 5783efa11bbSBrian Somerswith a zero address argument, then all new 5793efa11bbSBrian Somersincoming packets go to the address set by 5803efa11bbSBrian SomersPacketAliasSetAddress. 5813efa11bbSBrian Somers.Ss 6.2 PacketAliasCheckNewLink() 5823efa11bbSBrian Somers 5833efa11bbSBrian Somers.Ft int 5843efa11bbSBrian Somers.Fn PacketAliasCheckNewLink "void" 5853efa11bbSBrian Somers 5863efa11bbSBrian SomersThis function returns a non-zero value when 5873efa11bbSBrian Somersa new aliasing link is created. In circumstances 5883efa11bbSBrian Somerswhere incoming traffic is being sequentially 5893efa11bbSBrian Somerssent to different local servers, this function 5903efa11bbSBrian Somerscan be used to trigger when PacketAliasSetTarget() 5913efa11bbSBrian Somersis called to change the default target address. 5923efa11bbSBrian Somers.Ss 6.3 PacketAliasInternetChecksum() 5933efa11bbSBrian Somers 5943efa11bbSBrian Somers.Ft u_short 5953efa11bbSBrian Somers.Fn PacketAliasInternetChecksum "char *buffer" "int nbytes" 5963efa11bbSBrian Somers 5973efa11bbSBrian SomersThis is a utility function that does not seem 5983efa11bbSBrian Somersto be available elswhere and is included as a 5993efa11bbSBrian Somersconvenience. It computes the internet checksum, 6003efa11bbSBrian Somerswhich is used in both IP and protocol-specific 6013efa11bbSBrian Somersheaders (TCP, UDP, ICMP). 6023efa11bbSBrian Somers 6033efa11bbSBrian Somers.Em buffer 6043efa11bbSBrian Somerspoints to the data block to be checksummed, and 6053efa11bbSBrian Somers.Em nbytes 6063efa11bbSBrian Somersis the number of bytes. The 16-bit checksum 6073efa11bbSBrian Somersfield should be zeroed before computing the checksum. 6083efa11bbSBrian Somers 6093efa11bbSBrian SomersChecksums can also be verified by operating on a block 6103efa11bbSBrian Somersof data including its checksum. If the checksum is 6113efa11bbSBrian Somersvalid, PacketAliasInternetChecksum() will return zero. 6123efa11bbSBrian Somers 6133efa11bbSBrian Somers.Sh 7. Authors 61459354a4eSBrian SomersCharles Mott (cmott@srv.net), versions 1.0 - 1.8, 2.0 - 2.4. 6153efa11bbSBrian Somers 6168ddc51bcSEivind EklundEivind Eklund (eivind@freebsd.org), versions 1.8b, 1.9 and 6178ddc51bcSEivind Eklund2.5. Added IRC DCC support as well as contributing a number of 6188ddc51bcSEivind Eklundarchitectural improvements; added the firewall bypass 6198ddc51bcSEivind Eklundfor FTP/IRC DCC. 6203efa11bbSBrian Somers 6213efa11bbSBrian Somers.Sh 8. Acknowledgments 6223efa11bbSBrian Somers 6233efa11bbSBrian SomersListed below, in approximate chronological 6243efa11bbSBrian Somersorder, are individuals who have provided 6253efa11bbSBrian Somersvaluable comments and/or debugging assistance. 6263efa11bbSBrian Somers 6273efa11bbSBrian Somers.Bl -inset -compact -offset left 6283efa11bbSBrian Somers.It Gary Roberts 6293efa11bbSBrian Somers.It Tom Torrance 6303efa11bbSBrian Somers.It Reto Burkhalter 6313efa11bbSBrian Somers.It Martin Renters 6323efa11bbSBrian Somers.It Brian Somers 6333efa11bbSBrian Somers.It Paul Traina 6343efa11bbSBrian Somers.It Ari Suutari 6353efa11bbSBrian Somers.It Dave Remien 6363efa11bbSBrian Somers.It J. Fortes 6373efa11bbSBrian Somers.It Andrzej Bialeki 6384fe071a9SBrian Somers.It Gordon Burditt 6393efa11bbSBrian Somers.El 6403efa11bbSBrian Somers 6413efa11bbSBrian Somers.Sh Appendix: Conceptual Background 6423efa11bbSBrian SomersThis appendix is intended for those who 6433efa11bbSBrian Somersare planning to modify the source code or want 6443efa11bbSBrian Somersto create somewhat esoteric applications using 6453efa11bbSBrian Somersthe packet aliasing functions. 6463efa11bbSBrian Somers 6473efa11bbSBrian SomersThe conceptual framework under which the 6483efa11bbSBrian Somerspacket aliasing engine operates is described here. 6493efa11bbSBrian SomersCentral to the discussion is the idea of an 6503efa11bbSBrian Somers"aliasing link" which describes the relationship 6513efa11bbSBrian Somersfor a given packet transaction between the local 6523efa11bbSBrian Somersmachine, aliased identity and remote machine. It 6533efa11bbSBrian Somersis discussed how such links come into existence 6543efa11bbSBrian Somersand are destroyed. 6553efa11bbSBrian Somers.Ss A.1 Aliasing Links 6563efa11bbSBrian SomersThere is a notion of an "aliasing link", 6573efa11bbSBrian Somerswhich is 7-tuple describing a specific 6583efa11bbSBrian Somerstranslation: 6593efa11bbSBrian Somers.Bd -literal -offset indent 6603efa11bbSBrian Somers(local addr, local port, alias addr, alias port, 6613efa11bbSBrian Somers remote addr, remote port, protocol) 6623efa11bbSBrian Somers.Ed 6633efa11bbSBrian Somers 6643efa11bbSBrian SomersOutgoing packets have the local address and 6653efa11bbSBrian Somersport number replaced with the alias address 6663efa11bbSBrian Somersand port number. Incoming packets undergo the 6673efa11bbSBrian Somersreverse process. The packet aliasing engine 6683efa11bbSBrian Somersattempts to match packets against an internal 6693efa11bbSBrian Somerstable of aliasing links to determine how to 6703efa11bbSBrian Somersmodify a given IP packet. Both the IP 6713efa11bbSBrian Somersheader and protocol dependent headers are 6723efa11bbSBrian Somersmodified as necessary. Aliasing links are 6733efa11bbSBrian Somerscreated and deleted as necessary according 6743efa11bbSBrian Somersto network traffic. 6753efa11bbSBrian Somers 6763efa11bbSBrian SomersProtocols can be TCP, UDP or even ICMP in 6773efa11bbSBrian Somerscertain circumstances. (Some types of ICMP 6783efa11bbSBrian Somerspackets can be aliased according to sequence 6793efa11bbSBrian Somersor id number which acts as an equivalent port 6803efa11bbSBrian Somersnumber for identifying how individual packets 6813efa11bbSBrian Somersshould be handled.) 6823efa11bbSBrian Somers 6833efa11bbSBrian SomersEach aliasing link must have a unique 6843efa11bbSBrian Somerscombination of the following five quanties: 6853efa11bbSBrian Somersalias address/port, remote address/port 6863efa11bbSBrian Somersand protocol. This ensures that several 6873efa11bbSBrian Somersmachines on a local network can share the 6883efa11bbSBrian Somerssame aliased IP address. In cases where 6893efa11bbSBrian Somersconflicts might arise, the aliasing port 6903efa11bbSBrian Somersis chosen so that uniqueness is maintained. 6913efa11bbSBrian Somers.Ss A.2 Static and Dynamic Links 6923efa11bbSBrian SomersAliasing links can either be static or dynamic. 6933efa11bbSBrian SomersStatic links persist indefinitely and represent 6943efa11bbSBrian Somersfixed rules for translating IP packets. Dynamic 6953efa11bbSBrian Somerslinks come into existence for a specific TCP 6963efa11bbSBrian Somersconnection or UDP transaction or ICMP echo 6973efa11bbSBrian Somerssequence. For the case of TCP, the connection 6983efa11bbSBrian Somerscan be monitored to see when the associated 6993efa11bbSBrian Somersaliasing link should be deleted. Aliasing links 7003efa11bbSBrian Somersfor UDP transactions (and ICMP echo and timestamp 7013efa11bbSBrian Somersequests) work on a simple timeout rule. When 7023efa11bbSBrian Somersno activity is observed on a dynamic link for 7033efa11bbSBrian Somersa certain amount of time it is automatically 7043efa11bbSBrian Somersdeleted. Timeout rules also apply to TCP 7053efa11bbSBrian Somersconnections which do not open or close 7063efa11bbSBrian Somersproperly. 7073efa11bbSBrian Somers.Ss A.3 Partially Specified Aliasing Links 7083efa11bbSBrian SomersAliasing links can be partially specified, 7093efa11bbSBrian Somersmeaning that the remote address and/or remote 7103efa11bbSBrian Somersports are unkown. In this case, when a packet 7113efa11bbSBrian Somersmatching the incomplete specification is found, 7123efa11bbSBrian Somersa fully specified dynamic link is created. If 7133efa11bbSBrian Somersthe original partially specified link is dynamic, 7143efa11bbSBrian Somersit will be deleted after the fully specified link 7153efa11bbSBrian Somersis created, otherwise it will persist. 7163efa11bbSBrian Somers 7173efa11bbSBrian SomersFor instance, a partially specified link might 7183efa11bbSBrian Somersbe 7193efa11bbSBrian Somers.Bd -literal -offset indent 7203efa11bbSBrian Somers(192.168.0.4, 23, 204.228.203.215, 8066, 0, 0, tcp) 7213efa11bbSBrian Somers.Ed 7223efa11bbSBrian Somers 7233efa11bbSBrian SomersThe zeros denote unspecified components for 7243efa11bbSBrian Somersthe remote address and port. If this link were 7253efa11bbSBrian Somersstatic it would have the effect of redirecting 7263efa11bbSBrian Somersall incoming traffic from port 8066 of 7273efa11bbSBrian Somers204.228.203.215 to port 23 (telnet) of machine 7283efa11bbSBrian Somers192.168.0.4 on the local network. Each 7293efa11bbSBrian Somersindividual telnet connection would initiate 7303efa11bbSBrian Somersthe creation of a distinct dynamic link. 7313efa11bbSBrian Somers.Ss A.4 Dynamic Link Creation 7323efa11bbSBrian SomersIn addition to aliasing links, there are 7333efa11bbSBrian Somersalso address mappings that can be stored 7343efa11bbSBrian Somerswithin the internal data table of the packet 7353efa11bbSBrian Somersaliasing mechanism. 7363efa11bbSBrian Somers.Bd -literal -offset indent 7373efa11bbSBrian Somers(local addr, alias addr) 7383efa11bbSBrian Somers.Ed 7393efa11bbSBrian Somers 7403efa11bbSBrian SomersAddress mappings are searched when creating 7413efa11bbSBrian Somersnew dynamic links. 7423efa11bbSBrian Somers 7433efa11bbSBrian SomersAll outgoing packets from the local network 7443efa11bbSBrian Somersautomatically create a dynamic link if 7453efa11bbSBrian Somersthey do not match an already existing fully 7463efa11bbSBrian Somersspecified link. If an address mapping exists 7473efa11bbSBrian Somersfor the the outgoing packet, this determines 7483efa11bbSBrian Somersthe alias address to be used. If no mapping 7493efa11bbSBrian Somersexists, then a default address, usually the 7503efa11bbSBrian Somersaddress of the packet aliasing host, is used. 7513efa11bbSBrian SomersIf necessary, this default address can be 7523efa11bbSBrian Somerschanged as often as each indvidual packet 7533efa11bbSBrian Somersarrives. 7543efa11bbSBrian Somers 7553efa11bbSBrian SomersThe aliasing port number is determined 7563efa11bbSBrian Somerssuch that the new dynamic link does not 7573efa11bbSBrian Somersconflict with any existing links. In the 7583efa11bbSBrian Somersdefault operating mode, the packet aliasing 7593efa11bbSBrian Somersengine attempts to set the aliasing port 7603efa11bbSBrian Somersequal to the local port number. If this 7613efa11bbSBrian Somersresults in a conflict, then port numbers 7623efa11bbSBrian Somersare randomly chosen until a unique aliasing 7633efa11bbSBrian Somerslink can be established. In an alternate 7643efa11bbSBrian Somersoperating mode, the first choice of an 7653efa11bbSBrian Somersaliasing port is also random and unrelated 7663efa11bbSBrian Somersto the local port number. 7673efa11bbSBrian Somers 768